CVE-2024-3272D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials
Updated under an hour ago ()
Does this affect you?
It affects D-Link DNS-320L and 23 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Apr 11, 2024; federal agencies had to remediate by May 2, 2024. Treat that date as your deadline.
Do this next
Free account, 1 product
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-798
- Known exploited
- Added to CISA KEV Apr 11, 2024; federal remediation due May 2, 2024This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 98.04% (percentile 100)
- Assigned by
- VulDB
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
D-Link DNS-320L d_link:dns_320l (from the name) | 20240403 | CNA record |
D-Link DNS-325 d_link:dns_325 (from the name) | 20240403 | CNA record |
D-Link DNS-327L d_link:dns_327l (from the name) | 20240403 | CNA record |
D-Link DNS-340L d_link:dns_340l (from the name) | 20240403 | CNA record |
dlink dns-320l_firmware dlink:dns-320l_firmware | 20240403 | CISA ADP |
dlink dns-325_firmware dlink:dns-325_firmware | 20240403 | CISA ADP |
dlink dns-327l_firmware dlink:dns-327l_firmware | 20240403 | CISA ADP |
dlink dns-340l_firmware dlink:dns-340l_firmware | 20240403 | CISA ADP |
dlink dns-320l_firmware dlink:dns-320l_firmware | 1.01.0702.2013; 1.03.0904.2013; 1.11 | NVD |
dlink dns-120_firmware dlink:dns-120_firmware | all versions | NVD |
dlink dnr-202l_firmware dlink:dnr-202l_firmware | all versions | NVD |
dlink dns-315l_firmware dlink:dns-315l_firmware | all versions | NVD |
dlink dns-320_firmware dlink:dns-320_firmware | all versions | NVD |
dlink dns-320lw_firmware dlink:dns-320lw_firmware | all versions | NVD |
dlink dns-321_firmware dlink:dns-321_firmware | all versions | NVD |
dlink dnr-322l_firmware dlink:dnr-322l_firmware | all versions | NVD |
dlink dns-323_firmware dlink:dns-323_firmware | all versions | NVD |
dlink dns-325_firmware dlink:dns-325_firmware | 1.01 | NVD |
dlink dns-326_firmware dlink:dns-326_firmware | all versions | NVD |
dlink dns-327l_firmware dlink:dns-327l_firmware | 1.00.0409.2013; 1.09 | NVD |
dlink dnr-326_firmware dlink:dnr-326_firmware | all versions | NVD |
dlink dns-340l_firmware dlink:dns-340l_firmware | 1.08 | NVD |
dlink dns-343_firmware dlink:dns-343_firmware | all versions | NVD |
dlink dns-345_firmware dlink:dns-345_firmware | all versions | NVD |
dlink dns-726-4_firmware dlink:dns-726-4_firmware | all versions | NVD |
dlink dns-1100-4_firmware dlink:dns-1100-4_firmware | all versions | NVD |
dlink dns-1200-05_firmware dlink:dns-1200-05_firmware | all versions | NVD |
dlink dns-1550-04_firmware dlink:dns-1550-04_firmware | all versions | NVD |
References
- https://vuldb.com/?id.259283vdb-entry, technical-description, third-party-advisory
- https://vuldb.com/?ctiid.259283signature, permissions-required
- https://github.com/netsecfish/dlinkexploit, third-party-advisory
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383related, vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3272us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.